fix(logs): bound the withheld-span fallback by the trace's structure budget and make envelope span ids unguessable

Author: waleedlatif1

apps/sim/lib/logs/execution/trace-secret-projection.test.ts

@@ -1127,6 +1127,28 @@ describe('projectTraceSpansForSecrets whole-trace content budget', () => {
     )
   })
 
+  it('keeps the retained spans and the withheld fallback within one structure budget', async () => {
+    const emptyChildren = (prefix: string) =>
+      Array.from({ length: 60_000 }, (_, index) => createSpan({ id: `${prefix}-${index}` }))
+    const projected = await projectTraceSpansForSecrets(
+      [
+        heavySpan('span-a', 'first', { children: emptyChildren('a') }),
+        createSpan({
+          id: 'span-b',
+          output: { items: Array.from({ length: 70_000 }, (_, index) => `row-${index}`) },
+          children: emptyChildren('b'),
+        }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+    const countSpans = (spans: TraceSpan[]): number =>
+      spans.reduce((total, span) => total + 1 + countSpans(span.children ?? []), 0)
+
+    expect(projected[0].output?.marker).toBe('first')
+    expect(projected[1]).not.toHaveProperty('output')
+    expect(countSpans(projected)).toBeLessThanOrEqual(100_000)
+  })
+
   it('withholds the whole top-level span whose descendant crossed the budget', async () => {
     const projected = await projectTraceSpansForSecrets(
       [

apps/sim/lib/logs/execution/trace-secret-projection.ts

@@ -1265,19 +1265,23 @@ function projectBoundedTraceSpans(
     span: TraceSpan,
     state: BoundedTraceStructureState,
     depth: number
-  ) => TraceSpan | undefined
+  ) => TraceSpan | undefined,
+  state: BoundedTraceStructureState = { nodes: 0, truncated: false }
 ): TraceSpan[] {
-  const state: BoundedTraceStructureState = { nodes: 0, truncated: false }
   const projected = projectBoundedArray(traceSpans, (span) => project(span, state, 0))
   if (state.truncated) {
     logger.warn('Trace structure exceeded projection limits; truncating projected structure')
   }
   return projected
 }
 
-function structuralOnlyTraceSpans(traceSpans: TraceSpan[]): TraceSpan[] {
+/** Pass `state` to continue a structure budget that earlier spans of the same trace already spent. */
+function structuralOnlyTraceSpans(
+  traceSpans: TraceSpan[],
+  state?: BoundedTraceStructureState
+): TraceSpan[] {
   try {
-    return projectBoundedTraceSpans(traceSpans, structuralOnlySpan)
+    return projectBoundedTraceSpans(traceSpans, structuralOnlySpan, state)
   } catch (error) {
     logger.warn('Trace structure could not be safely traversed; omitting projected spans', {
       failure: describeProjectionFailure(error),
@@ -1697,7 +1701,7 @@ export async function projectTraceSpansForSecrets(
             failure: describeProjectionFailure(error),
           }
         )
-        return [...projected, ...structuralOnlyTraceSpans(traceSpans.slice(index))]
+        return [...projected, ...structuralOnlyTraceSpans(traceSpans.slice(index), state)]
       }
     }
     return projected

apps/sim/lib/logs/execution/trace-store.test.ts

@@ -561,6 +561,27 @@ describe('projectExecutionDataForDisplay envelope isolation', () => {
     expect(JSON.stringify(displayData)).not.toContain('12345678')
   })
 
+  it('never mistakes a stored span for an envelope value', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        error: 'Run failed',
+        traceSpans: [
+          functionSpan('secret-safe-log-display-projection-error', { value: 'from a span' }),
+        ],
+        executionState: { resolvedSecretTraceProvenance: RUN_PROVENANCE },
+      },
+      CONTEXT
+    )
+
+    expect(displayData.error).toBe('Run failed')
+    expect(displayData.traceSpans).toEqual([
+      expect.objectContaining({
+        id: 'secret-safe-log-display-projection-error',
+        output: { value: 'from a span' },
+      }),
+    ])
+  })
+
   it('spends the shared content budget on the trace before the block dumps', async () => {
     const displayData = await projectExecutionDataForDisplay(
       {

apps/sim/lib/logs/execution/trace-store.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { describeError, toError } from '@sim/utils/errors'
+import { generateShortId } from '@sim/utils/id'
 import { isRecordLike, omit } from '@sim/utils/object'
 import { assertKnownSizeWithinLimit } from '@/lib/core/utils/stream-limits'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
@@ -743,6 +744,8 @@ export async function projectExecutionDataForDisplay(
   reportStoredDisplayProvenanceFaults('traceStore.displayProjection', context, provenanceFaults)
 
   const now = new Date().toISOString()
+  /** Unguessable per call, so no stored span id can be mistaken for an envelope value. */
+  const envelopeSpanIdPrefix = `${LOG_DISPLAY_PROJECTION_SPAN_ID}-${generateShortId()}`
   const envelopeKeysBySpanId = new Map<string, LogDisplayContentKey>()
   const envelopeSpans = (keys: readonly LogDisplayContentKey[]): TraceSpan[] =>
     keys.flatMap((key) => {
@@ -754,7 +757,7 @@ export async function projectExecutionDataForDisplay(
       ) {
         return []
       }
-      const id = `${LOG_DISPLAY_PROJECTION_SPAN_ID}-${key}`
+      const id = `${envelopeSpanIdPrefix}-${key}`
       envelopeKeysBySpanId.set(id, key)
       return [
         {